neconyd | 80bb9eba7fc0082b35bb6bad4f1619ea7e8bb8fdeb14657d591eb8d1646f13b4

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe
Size 96KB
Sample240522-afsntaee5t
SHA256 80bb9eba7fc0082b35bb6bad4f1619ea7e8bb8fdeb14657d591eb8d1646f13b4
MD5 1223f3fc984b9608c6893175381e40e0
SHA1 bb7fa957fe8cea49e891d39bc5deae34a4b78c9f
SHA512 d32ee5b2dc686fc2e457ba7f6c322229aa69915409f728c841d99923d75469cd722e3e8d364ce15a6643dd429aac14ec07ac98df96d957b49f2ef0eb1fbddf1e
SSDEEP 1536:dnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:dGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Malware Config

Extracted

Family

neconyd

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/

Signatures

Neconyd
Neconyd is a trojan written in C++.
trojan neconyd

Executes dropped EXE 6 IoCs

pid	Process
4664	omsecor.exe
4696	omsecor.exe
4112	omsecor.exe
3008	omsecor.exe
4952	omsecor.exe
3956	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1228	1688	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	82
PID 4664 set thread context of 4696	4664	omsecor.exe	86
PID 4112 set thread context of 3008	4112	omsecor.exe	107
PID 4952 set thread context of 3956	4952	omsecor.exe	111

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4224	1688	WerFault.exe	81
1160	4664	WerFault.exe	84
5084	4112	WerFault.exe	106
2032	4952	WerFault.exe	109

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1228	1688	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	82
PID 1688 wrote to memory of 1228	1688	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	82
PID 1688 wrote to memory of 1228	1688	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	82
PID 1688 wrote to memory of 1228	1688	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	82
PID 1688 wrote to memory of 1228	1688	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	82
PID 1228 wrote to memory of 4664	1228	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	84
PID 1228 wrote to memory of 4664	1228	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	84
PID 1228 wrote to memory of 4664	1228	1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe	84
PID 4664 wrote to memory of 4696	4664	omsecor.exe	86
PID 4664 wrote to memory of 4696	4664	omsecor.exe	86
PID 4664 wrote to memory of 4696	4664	omsecor.exe	86
PID 4664 wrote to memory of 4696	4664	omsecor.exe	86
PID 4664 wrote to memory of 4696	4664	omsecor.exe	86
PID 4696 wrote to memory of 4112	4696	omsecor.exe	106
PID 4696 wrote to memory of 4112	4696	omsecor.exe	106
PID 4696 wrote to memory of 4112	4696	omsecor.exe	106
PID 4112 wrote to memory of 3008	4112	omsecor.exe	107
PID 4112 wrote to memory of 3008	4112	omsecor.exe	107
PID 4112 wrote to memory of 3008	4112	omsecor.exe	107
PID 4112 wrote to memory of 3008	4112	omsecor.exe	107
PID 4112 wrote to memory of 3008	4112	omsecor.exe	107
PID 3008 wrote to memory of 4952	3008	omsecor.exe	109
PID 3008 wrote to memory of 4952	3008	omsecor.exe	109
PID 3008 wrote to memory of 4952	3008	omsecor.exe	109
PID 4952 wrote to memory of 3956	4952	omsecor.exe	111
PID 4952 wrote to memory of 3956	4952	omsecor.exe	111
PID 4952 wrote to memory of 3956	4952	omsecor.exe	111
PID 4952 wrote to memory of 3956	4952	omsecor.exe	111
PID 4952 wrote to memory of 3956	4952	omsecor.exe	111

C:\Users\Admin\AppData\Local\Temp\1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe
  C:\Users\Admin\AppData\Local\Temp\1223f3fc984b9608c6893175381e40e0_NeikiAnalytics.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Roaming\omsecor.exe
    C:\Users\Admin\AppData\Roaming\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Users\Admin\AppData\Roaming\omsecor.exe
      C:\Users\Admin\AppData\Roaming\omsecor.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\System32\omsecor.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4112
      - C:\Windows\SysWOW64\omsecor.exe
        
        C:\Windows\SysWOW64\omsecor.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        
        C:\Users\Admin\AppData\Roaming\omsecor.exe
        8⤵
        Executes dropped EXE
        
        PID:3956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 256
        8⤵
        Program crash
        
        PID:2032
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 304
        6⤵
        Program crash
        
        PID:5084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 288
      4⤵
      Program crash
      PID:1160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 288
  2⤵
  - Program crash
  PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1688 -ip 1688
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4664 -ip 4664
1⤵
PID:3528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4112 -ip 4112
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4952 -ip 4952
1⤵
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 c2866857d9af4871f22ecebc6a8f4374364aa1887a5301585ce8deeda8d4495f
MD5 89e0171902c45dd156f5080652630205
SHA1 f6146f1eb19ace9551403a287ad95b6ee612e9b5
SHA512 1e40f6f202d3a7645bac9e84ba74783c309a05f020857d74b25dd1f53e874485698ded85c712e11f0c79146ff5e05d3efa85b973ed14cc043df59224cd55d820
SSDEEP 1536:pnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:pGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 96KB
SHA256 0c6bb14829ca1ca5f7986c94101df240d290c143ee2d13cf5e5110a0c67f42de
MD5 d05aceaab0f4fa62ea57774190c75dac
SHA1 d619a49bf0a490b4fe91fbe5a8b3f62e76b0da15
SHA512 ab87ce51b4a63a33021ee123a722706fd91546eca297da0965d41fd40289eaa818612fabc1ef6314e5d350bd3601d83b4caee15a310a661c2115a55d4551509c
SSDEEP 1536:xnAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:xGs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 96KB
SHA256 53f8715a16388bb243cd49d436333a99431fa5ca9f2cadf5473cf5199c266884
MD5 1edbf17e2588f6b9e2086f73515ceb98
SHA1 cdc1e7c4df486d868663b1e0d40871245c8b3dea
SHA512 8ab454e7d6732310cfb90f9ef59ac78ce0fbb35aa91f88ec969e123bba339bf6042e901e15f95972b42bbe0556426b9ce45630f21d990c396072d1316a60c93a
SSDEEP 1536:1nAHcBbLmdvduLd8IDiaP/8A68YaiIv2RwEYqlwi+BzdAeV9b5ADbyxxL:1Gs8cd8eXlYairZYqMddH13L
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1228-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1228-2-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1228-3-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1228-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1688-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/1688-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3008-38-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3008-35-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3008-36-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3956-56-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3956-49-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3956-47-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3956-53-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4112-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4112-31-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4664-11-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4696-15-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4696-29-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4696-25-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4696-24-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4696-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4696-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4696-14-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4952-43-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4952-52-0x0000000000400000-0x0000000000423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads